CVE-2023-23638

For learning and research purposes only.

ZooKeeper is required.

The test environment is Java 8. Other versions have not been tested and usability is not guaranteed.

During reproduction, you need to add the VM parameter to DemoComsumer: -Ddubbo.hessian.allowNonSerializable=true. For details, refer to https://su18.org/post/hessian/#serializable

Analysis article: https://exp10it.io/2023/03/apache-dubbo-cve-2023-23638-%E5%88%86%E6%9E%90/

The essence of the POC is to use a certain class to modify properties to bypass restrictions. The code provided is for JNDI injection. You can refer to CVE-2023-23638 Apache Dubbo JavaNative Deserialization Vulnerability Analysis to modify it into a deserialization exploit method.